HIPAA-compliant cloud backup and disaster recovery

Frequently Asked Questions

• What are the consequences of data loss in health care?

  Insufficient cybersecurity and data protection can leave health care organizations open to a variety of adverse consequences. Each could be devastating to the long-term health and viability of an organization:
  
  • Downtime
  
  • Data loss
  
  • Susceptibility to cybercriminal extortion
  
  • Regulatory fines
  
  • Reputational damage

• How often should health care data be backed up?

  Performing regular backups is essential to protecting health care data, including patient information, organizational assets and critical financial information. Data of high criticality requires backup at more frequent intervals. For many health care providers, this means backups are performed every 24 hours.

• Why is data interoperability important in health care?

  Interoperability ensures health care data remains accessible and functional throughout patient care. As average life expectancy continues to climb, so does patient data. Facing higher volumes of data and the ongoing digital transformation of the industry, health care providers struggle to maintain accurate, clear and secure data across systems and processes in patient care.
  
  Most patients receive interconnected care, so their personal data is routinely transmitted between systems, clinicians, other health care workers and themselves. Interoperability can help simplify connectivity between health care organizations and improve secure sharing of patient information. This is key to delivering successful patient outcomes. Additionally, health data interoperability is recognized and supported by HIPAA.

• How can encryption help protect health care data during backup and recovery?

  Encryption is a vital security measure to safeguard all stored data, including backups. When data is encrypted, information is rendered useless to cyberattackers that gain access to it. By encrypting backups, health care institutions not only protect against data theft and loss, but also avoid costly and reputation-damaging compliance sanctions.
  
  Encryption is a cornerstone of data integrity for HIPAA-compliant backup and cloud storage. It is one of the most effective ways to defend the accuracy, privacy and accessibility of patient data, including PHI, EHR and various kinds of sensitive data. Encryption also helps control access to sensitive patient information by allowing only authorized, key-equipped individuals to read it.

• What are the differences between on-site and off-site backup?

  On-site backup solutions store data copies on physical hard drives, media and on-premise servers to safeguard backups away from at-risk systems. One benefit of on-site backup is that data remains close at hand, easily retrievable in a cyberattack or unforeseen event, and quickly recoverable without an internet connection.
  
  Off-site backup solutions duplicate data to a distinct geographical location secluded from the primary production system. The most common example of off-site backup includes cloud-based backup that stores data to a cloud that is managed by a cloud service provider.

• What is hybrid backup?

  Hybrid backup solutions combine the advantages of on-site and off-site backup, providing better cyber resilience against attacks and natural disasters. The two methods work harmoniously to provide swift access to essential data through local backups, while also reinforcing security through cloud backup. The result gives health care providers the benefit of accessing restored, critical data quickly in emergency situations without sacrificing the security and integrity of backup repositories.

• How can health care organizations recover from ransomware attacks?

  Recovering from ransomware attacks is a complex process that requires careful steps to minimize the impact of damage. For health care organizations, these procedures are even more pivotal because of the interconnected systems, sophisticated operations and large volumes of patient data that are involved.
  
  Incident response plans (IRP) are a fundamental and preparational measure against ransomware attacks on health care organizations. Developing a comprehensive IRP will ensure processes, steps and responsibilities are outlined in a cyberattack. IRPs help health care institutions prepare and establish clear actions to identify, contain and resolve cyber incidents quickly. This preparedness reduces confusion, disruption and downtime with health care operations in the wake of a malware attack, while safeguarding the business continuity that is essential to emergency medical care. Additionally, IRPs help IT organizations diagnose and remediate the missteps and vulnerabilities that provided an opening for the cyberattack, enabling improvement of defenses against future threats.